Build one TXT for _dmarc. Start at p=none with reporting, then tighten when SPF and DKIM are clean.
Leave at 100 unless you are ramping enforcement.
One TXT at _dmarc. If a record already exists, edit it. Do not add a second.
v=DMARC1; p=none
The generator is a concatenator with a policy opinion: start at p=none, put a real rua= on it, publish one TXT at _dmarc. Enforcement is a later edit, not the first paste.
Same parser as the DMARC checker. If it warns about monitoring-only, that is the point on day one.
Look up the live _dmarc TXT after you publish.
Score SPF, DKIM, DMARC, and MX together.
Start with p=none and a rua= address you control. Publish one TXT at _dmarc. Read reports for two to four weeks, then move to quarantine, then reject. Do not jump to reject if you have not listed every sender in SPF and DKIM.
An inbox that can receive XML aggregate reports, often dmarc@yourdomain.com. This generator prefixes mailto: if you omit it. Forensic ruf= reports are optional and many providers never send them.
Only if subdomains should use a different policy than the apex. If you omit sp=, they inherit p=. Set sp=none if marketing mail goes out of send.yourdomain.com and you are not ready to enforce there.
It applies the policy to a percentage of failing mail. Use it to ramp quarantine or reject. Leave it at 100 unless you are in the middle of a rollout.
Relaxed (default) allows a subdomain to align with the From domain. Strict requires an exact match. Most ESPs need relaxed. Only switch to strict when every signer uses the exact From domain.
No. Copy the TXT to _dmarc at your DNS host, wait for propagation, then check it with the DMARC checker.
A generated record is the easy part. A free audit covers authentication, list quality, and sending habits.
Get Your Free Audit →